CVE-2023-53923

None

CVSS

—

EPSS

0.6%

Published

Dec 17, 2025

CISA due date

—

The record

UliCMS 2023.1 contains a privilege escalation vulnerability that allows unauthenticated attackers to create administrative accounts through the UserController endpoint. Attackers can send a crafted POST request to /dist/admin/index.php with specific parameters to generate a new admin user with full system access.

Affected packages

Ecosystem	Package	Introduced	Fixed